At M.R.Link Technology ("we", "us", "our"), protecting the privacy, confidentiality, and integrity of our clients' and web visitors' personal data is fundamental to our engineering ethics. This Privacy Policy sets out the principles governing our collection, handling, storage, and processing of personal data in strict accordance with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (PDPA) and internationally recognized data privacy standards.

This policy applies to all visitors of our web application (mr-link-technologys.pages.dev), customers interacting via our WhatsApp booking engines, and clients seeking our IT, CCTV, networking, repair, and academy services.

We only collect information that is strictly necessary to fulfill your technical inquiries and deliver certified IT solutions:

• Direct Customer Inquiries: Name, contact phone/WhatsApp number, and technical descriptions or equipment error notes submitted via quote forms.
• Identity & Bank Access Verification: When requesting access to our verified commercial banking details, we collect and verify your Gmail/Email address (via 6-digit One-Time Passcode or 1-Tap Google Sign-In), full name, billing/delivery street address, town/city, and postal code.
• Job Tracking & Diagnostics Data: Unique Tracking ID (e.g., MRL-XXXX), serial numbers of surrendered computers or CCTV equipment, diagnostic inspection logs, and repair handover records.
• Client Reviews & Testimonials: Display name, star rating, service feedback, and optional testimonial commentary submitted voluntarily.
• Automated Cyber-Security & Access Logs: For server protection, DDoS prevention, and rate-limiting brute-force attempts, our security engine automatically logs timestamp, IP address, device user-agent string, and HTTP referrers.

Pursuant to the Sri Lanka PDPA, M.R.Link processes personal information under the following lawful bases:

• Consent: You provide explicit consent when submitting quote requests, posting reviews, or entering your email for OTP verification.
• Performance of Contract: Processing necessary to repair your hardware, install CCTV systems, deliver web code, and issue invoices.
• Legitimate Interests: Protecting our infrastructure, preventing fraud, maintaining accurate repair logs, and defending our systems against cyber attacks.

We utilize collected information solely for legitimate business operations:

• To prepare accurate quotations and communicate technical updates regarding your repair or installation job.
• To authenticate verified customer identities before disclosing our Commercial Bank payment coordinates.
• To maintain real-time status synchronization across your mobile and desktop devices.
• To dispatch warranty certificates and provide post-installation technical support.
• Zero Spam Policy: We never engage in automated marketing robocalls, unsolicited spam emails, or unauthorized third-party cross-promotions.

To deliver cloud-scale performance, we work strictly with enterprise infrastructure providers who maintain high security certifications:

• Google Cloud & Firebase: For real-time database persistence, Firestore rules enforcement, and Google Auth.
• Cloudflare Inc.: Global CDN caching, SSL/TLS handshake termination, and DDoS firewall filtering.
• WhatsApp (Meta Platforms): Used solely as an end-to-end encrypted messaging channel when you choose to connect with our engineers.
• Google Analytics (G-4JCV1D8CPV): Aggregated, anonymized telemetry metrics to analyze web performance and optimize loading speeds.

We deploy defense-in-depth security measures to protect your information:

• Transport Layer Security (TLS 1.3 / 256-bit SSL): All data transmitted between your browser and our web application is encrypted end-to-end.
• Security Rules Enforcement: Cloud databases are isolated with strict Firestore database rules preventing unauthorized table dumps or unauthenticated reading.
• Administrative Access Control: Access to customer repair logs and inquiries is restricted to authenticated engineering personnel through encrypted multi-factor credentials.

Personal data is retained only for as long as necessary to complete your service agreement and satisfy statutory accounting or warranty requirements (typically 12 to 24 months following service completion). You retain the right to request permanent erasure of your inquiry history at any time.

Under Part II of the Sri Lanka Personal Data Protection Act No. 9 of 2022, you are entitled to:

• Right of Access: Request a summary of the personal data we hold regarding your transactions or repairs.
• Right to Rectification: Request the correction of inaccurate or outdated contact or billing records.
• Right to Erasure ('Right to be Forgotten'): Request the deletion of your personal data where retention is no longer justified.
• Right to Withdraw Consent: Revoke previously granted consent for processing at any time without penalty.

Our web application does NOT use invasive third-party tracking cookies. We utilize browser localStorage purely for essential client-side state:

• mrlink_preferred_theme: Remembers whether you prefer Dark or Light UI mode.
• mrlink_preferred_lang: Remembers your language preference (English or Sinhala).
• mrlink_verified_user: Caches your verified identity token locally so you do not have to re-enter OTP each time you view bank details.

To exercise your privacy rights, file a data access or deletion request, or raise questions regarding this policy, please reach out directly to our Data Protection team: